libTiMidity through version 0.2.8 contains an out‑of‑bounds memory access in the function init_soundfont() located in src/sndfont.c. When a SoundFont preset header provides a bank or preset index that exceeds the 128‑entry tonebank or drumset arrays, the program reads or writes beyond the intended array bounds, corrupting heap memory. This corruption can cause the application to crash and, if an attacker controls the overwritten data, may lead to further compromise of the process.

The vulnerable code is present in the open‑source project libTiMidity maintained by sezero. All releases up to and including 0.2.8 are affected; versions newer than 0.2.8 are presumed to include the fix, though the exact patch release is not documented here.

The CVSS score of 6.9 classifies the vulnerability as moderate. An EPSS score of less than 1% indicates a low likelihood of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Attackers would need to supply a specially crafted, untrusted .sf2 file that the target system processes; this might occur through file uploads, downloads, or manual opening of the file. Successful exploitation can corrupt heap memory and cause crashes, and the extent to which it enables remote code execution depends on the attacker’s ability to overwrite critical control data.